admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'ransom_ttp2' of https://github.com/splunk/security_content into ransom_ttp2

Browse Source
This commit is contained in:
Detection Testing Service
2021-07-05 14:52:28 +00:00
parent 2fbeb9c005 808eba05e4
commit c8eae0d7ca
5 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
-1
View File
@@ -28,7 +28,6 @@ references:
tags:
analytic_story:
- Ransomware
- Revil
kill_chain_phases:
- Exploitation
mitre_attack_id:
detections/endpoint/allow_network_discovery_in_firewall.yml
+1 -1
View File
@@ -29,7 +29,7 @@ references:
tags:
analytic_story:
- Ransomware
- Revil
- Revil Ransomware
kill_chain_phases:
- Exploitation
mitre_attack_id:
detections/endpoint/disable_windows_behavior_monitoring.yml
+1 -1
View File
@@ -33,7 +33,7 @@ tags:
analytic_story:
- Windows Defense Evasion Tactics
- Ransomware
- Revil
- Revil Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
detections/endpoint/msmpeng_application_dll_side_loading.yml
+1 -1
View File
@@ -26,7 +26,7 @@ references:
tags:
analytic_story:
- Ransomware
- Revil
- Revil Ransomware
kill_chain_phases:
- Exploitation
mitre_attack_id:
detections/endpoint/powershell_disable_security_monitoring.yml
+1 -1
View File
@@ -26,7 +26,7 @@ references:
tags:
analytic_story:
- Ransomware
- Revil
- Revil Ransomware
kill_chain_phases:
- Exploitation
mitre_attack_id: